CVE-2019-9085 Denial of service in n/a
Authenticated users can cause a denial of service in invoice creation by sending invalid arguments to the n_file parameter.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-9085?
CVE-2019-9085 is a medium-severity denial of service vulnerability in n/a, published on 24 Jun 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Hoteldruid before v2.3.1 allows remote authenticated users to cause a denial of service (invoice-creation outage) via the n_file parameter to visualizza_contratto.php with invalid arguments (any non-numeric value), as demonstrated by the anno=2019&id_transazione=1&numero_contratto=1&n_file=a query string to visualizza_contratto.php.
Weakness: CWE-20
Which versions are affected by CVE-2019-9085?
It affects 1 product.
Products include Digitaldruid Hoteldruid.
How do I fix CVE-2019-9085?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-9085 being exploited?
There is no known exploitation of CVE-2019-9085 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2019-9085, GHSA-r277-6cx2-9m3r, UBUNTU-CVE-2019-9085.